devopsby automateyournetwork
GCP Cloud Logging
automateyournetwork/gcp-cloud-logging
Google Cloud Logging — log search, VPC flow logs, firewall logs, audit logs, log buckets and views.
What it changes
Passed 17 of 20 test cases with the skill, and 13 of 20 without it.
Without skill64%
With skill86%
Checks it passed that the model alone missed
- Uses get_view to fetch log view details
- Uses list_views to list log views in the bucket
- Includes reporter="DEST" in the filter expression
and 3 more in the full report
6 fixed13 passed either way2 still failing1 broke
- Pass-rate lift
- +23 pp
- Tokens
- +57%
- Agent turns
- 0%
- Response time
- -19%
Model gemini-3.6-flashMeasured 8/16/2026v119 of 22 cases passed with skill · 20 comparable
See it in action
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
PromptWhich environment variable must be set to define the target Google Cloud project ID when connecting to the logging service?
What was checked, without and with the skill| Checked | Without skill | With skill |
|---|
| Names GCP_PROJECT_ID as the required environment variable | Missed | Passed |
|---|
What's inside
The instructions your model reads when the skill loads.
SKILL.md122 linessingle file
GCP Cloud Logging
MCP Server
- Endpoint:
https://logging.googleapis.com/mcp (Streamable HTTP)
- Auth: OAuth 2.0 via Google IAM — service account key (
GOOGLE_APPLICATION_CREDENTIALS) or gcloud auth application-default login
- Requires:
GCP_PROJECT_ID environment variable
Available Tools (6)
Workflow: VPC Flow Log Analysis
When investigating GCP network traffic:
- Discover logs:
list_log_names — find compute.googleapis.com/vpc_flows
- Query flow logs:
list_log_entries filtered by:
- Source/destination IP
- Port and protocol
- Action (ALLOWED/DENIED)
- Time range
- Denied traffic: Filter for
reporter="DEST" and denied connections
- Top talkers: Aggregate by source/destination IP and bytes
- Cross-reference: Use
gcp-cloud-monitoring for network metrics during the same period
- Report: Traffic analysis with security findings
Workflow: Firewall Log Investigation
When investigating GCP firewall rule activity:
- Discover logs:
list_log_names — find compute.googleapis.com/firewall
- Query firewall logs:
list_log_entries filtered by:
Track record
Benchmark
17 / 20
test cases passed, vs 13 / 20 without
Adoption
- Users
- 0
- Times used
- 0
Safety and source details
SkillSafety
✓ 3 of 3 passed✓Code scan15 of 15 checks clean
0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026
View 15 scanner checks
live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing
✓IntentSafe
LLM judge · does the skill do what it claims
✓ContentClean
LLM judge · policy & harmful-content review
Source
Importedautomateyournetwork / netclaw
workspace/skills/gcp-cloud-logging/SKILL.md
License Apache-2.0Imported 8/3/2026Version v1